SAP WEB DISPATCHER · CVE-2026-89119 · Vendor
NO FIX YET
SAP Web Dispatcher and the NetWeaver ABAP Internet Communication Manager do not validate requests in some administrative functions. An unauthenticated attacker who tricks a logged-on administrator into opening a malicious link can trigger unintended admin actions, which the sources say could lead to full compromise of the underlying operating system.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP Web Dispatcher or SAP NetWeaver Application Server ABAP with the Internet Communication Manager are the exposed systems, and the attack needs a logged-on administrator to open a link. The sources do not list affected versions or the specific administrative functions involved. unknown
Not affected if unknown
Who cares csrf, sap, sap-netweaver, sap-web-dispatcher, self-hosted
Unknown from the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.